vimeo-download.com Cross Site Scripting vulnerability OBB-1288434

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Identifying a Person Based on a Photo, LinkedIn and Etsy Profiles, and Other Internet Bread Crumbs

Interesting story of how the police can identify someone by following the evidence chain from website to website. According to filings in Blumenthal's case, FBI agents had little more to go on when they started their investigation than the news helicopter footage of the woman setting the police c...

Lazysizes Cross-Site Scripting Vulnerability

lazysizes is a lightweight inert loader. It is mainly used for delayed loading of content such as images, iframes and scripts. A security vulnerability exists in lazysizes 5.2.0 and earlier versions, which stems from the program's failure to clean up the following attributes: data-vimeo,...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Cross-site Scripting (XSS)

Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...

ACCESS Act might improve data privacy through interoperability

Data privacy is back in Congressional lawmakers’ sights, as a new, legislative proposal focuses not on data collection, storage, and selling, but on the idea that Americans should be able to more easily pack up their user data and take it to a competing service—perhaps one that better respects...

Vimeo Slapped With Lawsuit Over Biometrics Privacy Policy

Vimeo, the popular ad-free video platform, is facing a lawsuit that alleges it stored people’s facial biometrics without their consent or knowledge. The lawsuit, which was filed on Sept. 20, claims Vimeo violated the Illinois Biometrics Information Privacy Act BIPA. This is a law that imposes...

openSUSE: Security Advisory for vlc (openSUSE-SU-2019:1909-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Vimeo: SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]

Using our upload feature, the user was able to force an SSRF to occur. For more information you can read my writeup: https://medium.com/@dPhoeniixx/vimeo-upload-function-ssrf-7466d8630437...

Top 10 Best Anime Movie Sites 2019

By Zehra Ali Are you a fan of anime movies? Look no further, here is a list of best anime movie sites. Entertainment is a major part of our lives and the Internet is the biggest source for it these days. There are several websites such as YouTube, DailyMotion, and Vimeo, etc. offering movies and ...

Joomla HWDVideoShare 1.5 Bypass / Database Disclosure / SQL Injection

Exploit Title : Joomla HWDVideoShare Components 1.5 SQL Injection / Database Disclosure / Incorrect Authorization Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 30/01/2019 Vendor Homepage : joomla.org hwdmediashare.co.uk Software Download Link :...

Weak Password Vulnerability in Vimeo Interactive Website Management System

Chengdu Vimeo Interactive Network Technology Co., Ltd. is a technology company whose main products or services are all kinds of website construction, space domain name. Weak password vulnerability exists in the website management system of Weimei Interactive, which can be exploited by attackers t...

Denial of Service in Online Media Asset Handling

Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...

Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

Vimeo: Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv

By modifying the Content-Type to be blank, during a PUT command, the researcher was able to upload files to the CDN. This has been resolved. It was possible to write and overwrite arbitrary files to the CDN vpe.cdn.vimeo.tv used for JS scripts delivery on the various in-scope assets using the PUT...

Argus Surveillance DVR 4.0.0.0 Directory Traversal Vulnerability

Exploit for cgi platform in category web applications + Credits: John Page aka hyp3rlinx + Source: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + ISR: Apparition Security Greetz: Greetz: indoushka | Eduardo | GGA Vendor...

Vimeo: Domain pointing to vimeo portfolio are prone to takeover using on-demand.

We thank @bugdiscloseguys for finding this issue. We were only checking \ on-demand to on-demand, but not on-demand to portfolio. Vimeo offers service for pro users to add custom domain under portfolios so that portfolios can be hosted on your subDomain, However Vimeo offers same feature for...

Vimeo: Reflected File Download (RFD) in download video

The researcher was able to craft a Reflected File Download during the re-download of a video previously uploaded...

Vimeo: Improper Authentication in Vimeo's API 'versions' endpoint.

The versions endpoint was exploitable by accounts that were not pro or business. Issue -- There was an authorization issue in versions endpoint, Which on exploiting could allow an attacker to leak private videos of pro/business users due to the fact version is only applicable for pro/business...

WordPress Jetpack plugin cross-site scripting vulnerability (CNVD-2018-01270)

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site. Jetpack is one of the plugin package contains a variety of features such as social sharing, social login and social...